formbook | d30ab232ed71b8b011f47a39468b10ff4252b0b8caa979a3d9dd679ff3f0b800

General

Target

2daefddc9456812219167d69dad58b3c.exe
Size

626KB
MD5

2daefddc9456812219167d69dad58b3c
SHA1

82608b1808df7840e30d5d0089e3457d0ee0077c
SHA256

d30ab232ed71b8b011f47a39468b10ff4252b0b8caa979a3d9dd679ff3f0b800
SHA512

b1e26b3626a40f843abdccc84b63215328f02cbf6d10a4daf9b12c33ebfc17bccf5313cb8025c9916daf88b55e9771ee1ec47e3d0a9f5ddbb0acf9c421ffe7c9
SSDEEP

12288:IDyCK2xrOoLtXlGf+Dg5BVVAAbX8sUL7epov6XdTnhPNEMEti3:KyC5Lpl/g9KCMsg3v6tTnhPN7ai3

Score

10^/10

formbook pz12 execution rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2376-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2520 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

2daefddc9456812219167d69dad58b3c.exe

description pid process target process

PID 2000 set thread context of 2376 2000 2daefddc9456812219167d69dad58b3c.exe 2daefddc9456812219167d69dad58b3c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2daefddc9456812219167d69dad58b3c.exepowershell.exe

pid process

2376 2daefddc9456812219167d69dad58b3c.exe
2520 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2520 powershell.exe

resource	yara_rule
behavioral1/memory/2376-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

pid	process
2520	powershell.exe

description	pid	process	target process
PID 2000 set thread context of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe

pid	process
2376	2daefddc9456812219167d69dad58b3c.exe
2520	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2520	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2daefddc9456812219167d69dad58b3c.exe

description	pid	process	target process
PID 2000 wrote to memory of 2520	2000	2daefddc9456812219167d69dad58b3c.exe	powershell.exe
PID 2000 wrote to memory of 2520	2000	2daefddc9456812219167d69dad58b3c.exe	powershell.exe
PID 2000 wrote to memory of 2520	2000	2daefddc9456812219167d69dad58b3c.exe	powershell.exe
PID 2000 wrote to memory of 2520	2000	2daefddc9456812219167d69dad58b3c.exe	powershell.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe
PID 2000 wrote to memory of 2376	2000	2daefddc9456812219167d69dad58b3c.exe	2daefddc9456812219167d69dad58b3c.exe

C:\Users\Admin\AppData\Local\Temp\2daefddc9456812219167d69dad58b3c.exe
"C:\Users\Admin\AppData\Local\Temp\2daefddc9456812219167d69dad58b3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2daefddc9456812219167d69dad58b3c.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Users\Admin\AppData\Local\Temp\2daefddc9456812219167d69dad58b3c.exe
"C:\Users\Admin\AppData\Local\Temp\2daefddc9456812219167d69dad58b3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-12-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-1-0x0000000000C20000-0x0000000000CC2000-memory.dmp

Filesize
648KB

Download
memory/2000-2-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-3-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/2000-4-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/2000-5-0x0000000004910000-0x0000000004986000-memory.dmp

Filesize
472KB

Download
memory/2000-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download
memory/2376-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2376-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2376-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2376-11-0x0000000000CD0000-0x0000000000FD3000-memory.dmp

Filesize
3.0MB

Download
memory/2376-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2376-15-0x0000000000CD0000-0x0000000000FD3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing